..and I thought of offering some unsolicited advice for anyone who's interested in getting this certification. First of all, I followed the advice I found in these forums (thank you guys) regarding the study material and used the following resources to prepare for the exam (from most to least used):
- Darril Gibson’s SSCP All in One Exam Guide - 2011 Edition: despite the not-so-uncommon typos and content errors, it’s a surprisingly informative and easy to read book. The material is presented in a clear, practical, and easy to absorb fashion; which is something that you’ll immediately notice if you’re also reading the “Official Guide to the SSCP” (which in comparison seems cryptic and dense). The book is divided into 14 chapters and is not difficult to read 1 per day, which I found to be a quite comfortable pace. That being said, there’s some material that you’ll most likely encounter on the exam that isn’t covered in this book, so it’s important not to rely on it 100%. I also thought that the review questions at the end of each chapter where rather simple compared to the real ones, and this is rather dangerous since it might lead you to have a false sense of security about your real knowledge of the material. I constantly scored 90~100% percent in these sections, and I’m sure the score I got on the real exam wasn’t as high.
- Official (ISC)2 Guide to the SSCP CBK - 2nd Edition: Oh. God. This book made me hate studying for this exam. Since I wasn’t going to be able to go through the whole book from cover to cover (as I did with DG's guide - twice) due to time constraints, I decided to first do the review questions at the end of each chapter and then focus on my weak points. This is where I started to worry. There were a lot of topics that I had no idea where even part of the SSCP CBK. So far I considered crypto to be my strongest domain, and to my surprise it was there where I did the worst. For example, all the operation modes of block ciphers are not covered at all in DG’s exam guide, and in this book they are extensively covered. This was 4 days ago, so I started panicking a little since the exam date was close and I wasn’t in such a good stance as I had previously thought. I don’t know if it was the fact that most of the time I was reading this book late at night, often after long days, but I found it very difficult to digest. The writing style varies wildly from chapter to chapter, so there are some chapters that aren't such a pain to read, while others are just plain dense and boring. For example, in the Malware chapter you get to learn a little bit about the history of the first worms, viruses, their authors, their motivations, if they were caught or not, etc.. Even if this isn’t something you’ll likely encounter in the exam, it makes the book easier to read and the material easier to remember (at least for me). On the other hand, take the first chapter's definition of a subject: “An access control subject is an active entity and can be any user, program, or process that requests permission to cause data to flow from an access control object to the access control subject or between access control objects“ (Wat?). Now compare it with DG’s guide definition: “A subject access a resource, and an object is the resource being accessed” - that's it, that’s all you need to know right there, the rest is just reading well and reasoning the questions you’re being asked.
- (ISC)2 SSCP Webcasts: I think I haven't event finished receiving them in my inbox. I gave up on these after I watched the first 2. They barely scratch the surface, but then again they aren't meant to be your main resource. I guess they are more of a marketing tool for the formal (ISC)2 training. That being said, I think they are good to watch as an introduction to each domain and nothing more.
About the exam itself: you'll get some questions that seem to be specially worded to confuse you. So read well. Then re-read them. I went over some questions 3, 4 or more times. There's plenty of time so don't worry about spending more than a few minutes in each question. Then there are some other questions that I'm pretty sure weren't covered in any of those 2 books I mentioned. I remember one in special regarding a VoIP protocol that I could only answer because I've worked implementing the technology. But maybe it was one of those "test" questions. Go figure. Other than that, general networking knowledge will definitely work in your favour (solid knowledge of the OSI model, well known ports, protocols, WAN technologies, etc..).
Overall it's not such a difficult exam, but it's definitely not to be underestimated just because you have some infosec/ networking knowledge. That being said, I passed
Hope this is of any use to someone. I've got a lot out of this community as a lurker, and I just recently decided to register to give back whatever I can.
Cheers.
